OWASP Belgium

Participation

OWASP Foundation (Overview Slides) is a professional association of global members and is and open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.

Abstract: In this talk Tiago Teles takes apart password protection scheme analyzing the attack resistance of hashes, hmacs, adaptive hashes (such as script), and encryption schemes. First, we present a threat model for password storage. Then audience members will learn the construction, performance, and protective properties of these primitives. Discussion of the primitives will be from a critical perspective modeled as an iterative secure design session.

Ultimately, this session presents the solution and code donated as part an on-going OWASP project – a OWASP PSM (password storage module). Discussion of this solution will include key techniques for hardening PSM learned through years of delivering production JavaEE code to customers…

Bio: Tiago Teles is a Technical Consultant with 8 years of experience in clients across different sectors and countries, including banking, insurance, telecommunications and commercial organizations in a variety of roles: Delivering Training, Development, Business Intelligence and Quality Assurance. For some of the talks already delivered please see: Video talks for more information please visit: Tiago Teles' LinkedIn profile.

20h00 - 20h15: Break

20h15 - 21h15: A history of ATM violence - From blowing up safes over jackpotting to all-round malware (by Daan Raman and Erik Van Buggenhout)

Abstract: ATMs (Automated Teller Machines) are the main component of self-servicing banking functions used by millions of banking customers worldwide. To put things in perspective, 400,000 ATM devices were deployed in Europe alone as of 30 June 2013. Worldwide, the number of ATMs grew from 1.7 million to 2.5 million between 2007 and 2013.

This entertaining talk on attacks against Automated Teller Machines (ATMs) will focus on the history of ATM attacks and the current development of cross-vendor ATM malware. The talk will include a presentation of our from-scratch developed ATM malware that will be presented on a live ATM system (see http://youtu.be/MBOD59r3lTM).

Bio: Daan Raman and Erik Van Buggenhout are security consultants at NVISO, where they focus on information security topics in the financial services industry.

Last minute update:

I would like to notify you that due to traffic work you most probably will have to make a detour to get to the university campus.

Because of a road block at the Celestijnenlaan, this street has become one way. This forces participants coming from the E40/Koning Boudewijnlaan to reach the campus via the ring (R23)/Naamsesteenweg/Kardinaal Mercierlaan.

PROGRAM

Abstract: In the past few years tremendous cryptographic progress has been made in relation to primitives for privacy friendly-computations. These include celebrated results around fully homomorphic encryption, faster somehow homomorphic encryption, and ways to leverage them to support more efficient secret-sharing based secure multi-party computations. Similar break-through in verifiable computation, and succinct arguments of knowledge, make it practical to verify complex computations, as part of privacy-preserving client side program execution. Besides computations themselves, notions like differential privacy attempt to capture the essence of what it means for computations to leak little personal information, and have been mapped to existing data query languages.

So, is the problem of computation on private data solved, or just about to be solved? In this talk, I argue that the models of generic computation supported by cryptographic primitives are complete, but rather removed from what a typical engineer or data analyst expects. Furthermore, the use of these cryptographic technologies impose constrains that require fundamental changes in the engineering of computing systems. While those challenges are not obviously cryptographic in nature, they are nevertheless hard to overcome, have serious performance implications, and errors open avenues for attack.

Throughout the talk I use examples from our own work relating to privacy-friendly computations within smart grid and smart metering deployments for private billing, privacy-friendly aggregation, statistics and fraud detection. These experiences have guided the design of ZQL, a cryptographic language and compiler for zero-knowledge proofs, as well as more recent tools that compile using secret-sharing based primitives.

Bio: George Danezis is a Reader in Security and Privacy Engineering at the Department of Computer Science of University College London. He has been working on anonymous communications, privacy enhancing technologies (PET), and traffic analysis since 2000. He has previously been a researcher for Microsoft Research, Cambridge; a visiting fellow at K.U.Leuven (Belgium); and a research associate at the University of Cambridge (UK), where he also completed his doctoral dissertation under the supervision of Prof. R.J. Anderson.

Abstract: The heart of how users interact with a web application is the HTML form submission. A great deal of very sensitive data flows over HTML forms. Securing web form submissions is critical for the construction of a secure web application. Multi-form workflows make securing form submissions even more complicated! This presentation will take you on a journey as untrusted data flows from a form submission into the many layers of a secure web application.

Review some of the basic threats against web forms

Learn some of the most important defense categories for building secure web forms

Discuss some of the more complex aspects to form construction, such as workflow

Bio: Jim Manico is the VP of Security Architecture at WhiteHat Security. Jim has been a web application developer since 1997. He has also been an active member of OWASP since 2008 supporting projects that help developers write secure code.

The goal of this research is to bring a web proxy as close as possible to a browser to achieve a better security testing coverage, especially when dealing with complex client-side technology.

The presentation includes a montage of real case scenarios, showing how this approach can lead to the discovery of vulnerabilities which might otherwise go unnoticed.

Bio: Roberto loves breaking applications for fun and profit. In the last years, Roberto has been involved in the infosec community by founding the OWASP New Zealand chapter and by publishing vulnerabilities affecting major software products. Roberto has been a guest speaker at global security conferences, including HITB, EUSecWest, DEFCON, Ruxcon, Kiwicon and HackPra AllStars.

Abstract: Browser 0-days are very expensive and thus not available for the common attacker. Therefore an attacker may switch his focus from exploiting the browser towards exploiting the browser's internal network infrastructure. A normal webbrowser can serve as a pivot to attack the company's internal network. Internal networks are generally less protected and are potentially less segregated in terms of security, so pivoting through the browser can help the attacker to reach those otherwise unreachable targets.

The Browser Exploitation Framework, aka BeEF, is a professional security tool that can help you during a pentest performing these kinds of attacks.

Bio: Bart Leppens is one of the BeEF developers. During his talk he will introduce you to BeEF, Inter-Protocol Communication (IPC) & Inter-Protocol Exploitation (IPE). If you're thinking about buying an expensive firewall, it's advisable to wait until after his talk. There is a risk you might want to throw it all away.

PROGRAM

Everything security-conscious web developers should know to make their creations safer and more accessible for NoScript users, plus an overview of current and upcoming technologies inspired by NoScript which can be leveraged server-side to enhance web applications' security.

Giorgio Maone is a software developer and security researcher born and living in Palermo, Italy. He's member of the Mozilla Security Group and invited expert in the W3C's Web Application Security Working Group. In 2005 he created the NoScript browser security add-on, which still today absorbs most of the time and energy left by his main job: parenting 3 little children.

There is a way to build common, classic web applications. You know, servers, databases, some HTML and a bit of JavaScript. Ye olde way. Grandfather still knows. And there is a way to build hip and fancy, modern and light-weight, elastic and scalable client-side web applications. Sometimes with a server in the background, sometimes with a database - but all the hard work is done by something new: JavaScript Model-View-Controller and templating frameworks.

Angular, Ember and CanJS, Knockout, Handlebars and Underscore... those aren't names of famous wrestlers but modern JavaScript fame-works that offer a boost in performance and productivity by taking care of many things web-app right there in the browser, where the magic happens. And more and more people jump on the bandwagon and implement those frameworks with great success. High time for a stern look from the security perspective, ain't it not?

This talk will show you how those frameworks work, how secure their core is and what kind of security issues spawn from the generous feature cornucopia they offer. Do their authors really know the DOM well enough to enrich it with dozens of abstraction layers? Or did they open a gate straight to JavaScript hell introducing a wide range of new injection bugs and coding worst-practices? Well, you'll know after this talk. You'll know...

Mario Heiderich is founder of the German/UK pen-test outfit Cure53 and a Microsoft security contractor. He focuses on HTML5, SVG security, script-less attacks and believes XSS can be eradicated by using JavaScript. Maybe. Some day. Actually quite soon. Mario invoked the HTML5 security cheat-sheet, the Alexa Top 1x search engine Crawly and several other projects. In the remaining time he delivers trainings and security consultancy for larger German and international companies for sweet sweet money and the simple minded fun in breaking things. Mario has spoken on a large variety of international conferences - both academic and industry-focused, co-authored two books, several academic papers and doesn't see a problem in his one year old son having a tablet already. There you have it.

Using static analysis to identify software bugs is not a new paradigm. For years, developers have used static analysis tools to identifying code quality issues. While these tools may not be specifically designed for identifying security bugs. This presentation will discuss how custom security rules can be added to existing code quality tools to identify potential software security bugs. Writing custom software security rules for the popular Java code scanning tool PMD will be the focus of the presentation.

Justin Clarke is a Director and Co-Founder of Gotham Digital Science. He is the lead author/technical editor of "SQL Injection Attacks and Defense" (Syngress), co-author of "Network Security Tools" (O'Reilly), contributor to "Network Security Assessment, 2nd Edition" (O'Reilly), as well as a speaker at numerous security conferences and events such as Black Hat, EuSecWest, ISACA, BruCON, OWASP AppSec, OSCON, RSA and SANS. Justin is the Chapter Leader for the OWASP London chapter in the United Kingdom.

We present an approach to predict which components of a software system contain security vulnerabilities. Prediction models are a key instrument to identify the weak spots that deserve special scrutiny. Our approach is based on text mining the source code of an application. We have explored the potential of the bag-of-words representation and discovered that a dependable prediction model can be built by means of machine learning techniques. In a validation with 10 Android applications we have obtained performance results that often outclass state-of-the-art approaches.

This talk will take a look into the interesting world of vulnerability statistics. We have examined data for the last 25 years and used it to map out trends and general information on vulnerabilities in software. Some of the questions we look at are "What were the most popular vulnerabilities? Which had the most impact? Which vendors and products suffered from the most issues? Etc. While some of the statistics are predictable, others are surprising. This data was first introduced at RSA Conference San Francisco 2013.

Dr. Yves Younan is a Senior Research Engineer in the Vulnerability Research Team (VRT) at Sourcefire where he works on vulnerabilities and mitigations. Prior to joining Sourcefire, he worked as a Security Researcher with BlackBerry Security at Research In Motion. Before joining RIM, he was an academic, founding the Native Code Security group within the DistriNet research group at the KU Leuven in Belgium. He received a Master's degree in Computer Science from the Vrije Universiteit Brussel (VUB) and a PhD in Engineering: Computer Science from KU Leuven. His PhD focused on building efficient mitigations against vulnerability exploitation, several practical mitigations were published and presented at international conferences.

Designers of banking security systems are faced with a difficult challenge of developing technology within a tightly constrained budget, yet which must be capable of defeating attacks by determined, well-equipped criminals. This talk will summarise banking security technologies for protecting Chip and PIN/EMV card payments, online shopping, and online banking. The effectiveness of the security measures will be discussed, along with vulnerabilities discovered in them both by academics and by criminals. These vulnerabilities include cryptographic flaws, failures of tamper resistance, and poor implementation decisions, and have led not only to significant financial losses, but in some cases unfair allocation of liability. Proposed improvements will also be described, not only to the technical failures but also to the legal and regulatory regimes which are the underlying reason for some of these problems not being properly addressed.

Dr. Steven J. Murdoch is a Royal Society University Research Fellow in the Security Group of the University of Cambridge Computer Laboratory, working on developing metrics for security and privacy. His research interests include covert channels, banking security, anonymous communications, and censorship resistance. Following his PhD studies on anonymous communications, he worked with the OpenNet Initiative, investigating Internet censorship. He then worked for the Tor Project, on improving the security and usability of the Tor anonymity system. Currently he is supported by the Royal Society on developing methods to understand complex system security. He is also working on analyzing the security of banking systems especially Chip & PIN/EMV, and is Chief Security Architect of Cronto, an online authentication technology provider.

Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.